354 articles · page 16 of 18
Week of 11 January 2021
Before the 36-hour clock: deciding which bank incidents count
The banking agencies’ proposed notification rule looked like a deadline. The harder work sat upstream of it: a named judgment about what counts as material disruption, and vendor notices that reach the people making that judgment in time.
Week of 4 January 2021
Credit for security practice, payable only in arrears
A short HITECH amendment signed on January 5, 2021 told HHS to weigh recognized security practices when penalizing breaches. The credit requires a year of practice already in place, so it can only be earned before an incident, with evidence produced by daily operations.
Week of 28 December 2020
Why the ownership registry never replaced the bank’s own file
The Anti-Money Laundering Act of 2020 promised banks a federal register of who owns companies. The register was later cut back, the bank’s own due diligence duty stayed, and a new whistleblower channel changed who could report weak programs.
Week of 21 December 2020
How the No Surprises Act turned a medical bill into four data handoffs
The No Surprises Act was written as consumer protection. In practice it made the patient’s financial experience depend on four handoffs between schedulers, billing systems, health plans and an arbitration portal, and on whoever owned each one.
Week of 14 December 2020
SolarWinds and the three assumptions behind every update policy
The Orion compromise broke three things agencies took for granted: that a signed update is a safe update, that monitoring tools are low-risk plumbing, and that federal sensors would catch a national-scale intrusion. Only the second was quick to fix.
Week of 7 December 2020
Patient access is won or lost at the records counter
HHS’s December 2020 proposal to speed up patient access to records stalled, but it named the three places access actually fails: the response clock, the identity check and the delivery path. All three are operational, and none needed a final rule.
Week of 30 November 2020
Congress regulated connected devices by deciding what agencies may buy
The IoT Cybersecurity Improvement Act set no rules for manufacturers. It set rules for one very large customer. That shifted vulnerability-handling duties onto contractors and exposed an older problem: agencies cannot apply device rules to devices they have not inventoried.
Week of 23 November 2020
Three things a delayed federal transition moved at once
The late start to the 2020 presidential transition compressed a process that moves people and their access, records and accounts, and programs already in flight. Each needs its own runbook, prepared by career staff long before any election.
Week of 16 November 2020
Permission to donate cybersecurity arrived without the money to run it
New fraud-and-abuse protections let hospitals give cybersecurity to physician practices without cost sharing. The rule removed a legal obstacle; whether anything changed depended on donor economics, recipient capacity and who would operate the tools year after year.
Week of 9 November 2020
Who may see the vaccination record: the negotiation behind the rollout
The first strong COVID-19 vaccine result turned a scientific question into a logistics one. The hardest constraint for public agencies was data: matching people without a national identifier, agreeing who could see records, and onboarding hundreds of new sources in weeks.
Week of 2 November 2020
Exempt institution, covered data: what Proposition 24 meant for banks and hospitals
Proposition 24 created the first U.S. regulator dedicated to privacy. Banks and health systems that assumed federal law exempted them found that California exempts data governed by GLBA or HIPAA, not institutions, and that the remainder needed operational plumbing.
Week of 26 October 2020
Price transparency files: mandated, massive and hard to read
The Transparency in Coverage rule mandated publication of negotiated rates, not their usability. Whether the files were worth anything depended on volume, meaning and accountability, three engineering and governance problems the rule left to plans, employers and intermediaries.
Week of 19 October 2020
Antitrust moves in years; vendor dependency is set at signing
The Justice Department’s search case opened a long fight over platform power. For regulated buyers it offered no relief on their own concentration risk, which is decided in contracts, architecture and tested exit plans on a timeline no court can match.
Week of 12 October 2020
Why one phone call beat Twitter’s login controls
New York’s report on the Twitter hack described a phone call and a fake login page, not an exploit. With staff dispersed, the people who verify callers and reset credentials were a control most organizations had never designed, staffed or measured as one.
Week of 5 October 2020
Citi’s orders put data lineage on the safety and soundness agenda
The October 2020 actions against Citigroup treated weak data governance as a safety and soundness failure, alongside risk management and controls. Every bank inherited the expectation that it can show where its important numbers come from and who answers for them.
Week of 28 September 2020
From crisis call to compliance record: OFAC’s ransomware advisory
Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and the firms that help them pay, which moved the decision from the crisis room into a governed, documented compliance process.
Week of 21 September 2020
What a nationwide EHR outage at UHS asked of nurses and unit leaders
When Universal Health Services lost systems across its network in September 2020, the downtime binder mattered less than whether staff trained on electronic records could run a unit on paper for days, and then put it all back.
Week of 14 September 2020
Filing is not finding: FinCEN’s effectiveness question meets the FinCEN Files
In one September week, FinCEN asked how to define an effective AML program and leaked reports showed banks filing dutifully while flagged activity continued. The gap between volume, usefulness and action was a data and decision problem that compliance metrics hid.
Week of 7 September 2020
When a hospital diverts, the whole region absorbs the attack
The Düsseldorf ransomware attack is remembered for a disputed death. Its lasting lesson for health systems is regional: cyber diversion moves clinical risk onto ambulances and neighboring hospitals that rarely plan for it, and rarely measure it.
Week of 31 August 2020
Blackbaud’s breach exposed patient data that fundraising never needed
The Blackbaud ransomware incident reached health systems through their foundations. It showed that philanthropy databases held more patient information, for longer, than HIPAA’s fundraising permission required, and that minimization is the control that still works after the others fail.